Chapter 4: Architecture Design

Typical system topology, physical device wiring, inter-zone access matrix, and HA design patterns for production-grade segmentation deployments.

4.1 Typical System Topology

The typical system topology for a production-grade segmentation deployment organizes security enforcement and operational tooling into eight distinct zones, each with a defined trust level and a set of permitted inter-zone flows. The topology is designed to be modular — organizations can implement a subset of zones initially and expand over time as their security maturity grows. The minimum viable deployment includes an edge NGFW, a DMZ zone, an Office zone, a Production zone, and a Management zone with a bastion host.

The topology diagram below illustrates the full reference architecture, including all eight zones, the enforcement points at each boundary, and the labeled traffic flows between zones. Every arrow in the diagram represents a documented, controlled conduit — there are no implicit trust relationships between zones.

Figure 4.1: Typical System Topology — Complete eight-zone reference architecture showing edge NGFW HA pair, DMZ (WAF/API/ZTNA), Office (NAC/endpoints), Production (ISFW/apps/LB), Data (DB/DLP), Management (bastion/PAM), Security (SIEM/SOAR), and isolated Dev/Test zone with labeled inter-zone traffic flows.

Zone Trust Hierarchy

The trust hierarchy defines the default posture between zones. A higher trust level does not mean unrestricted access — it means that the zone contains more sensitive assets and therefore receives more protective controls. The table below summarizes the trust level, default inter-zone stance, and the primary enforcement mechanism for each zone.

4.2 Physical Device Wiring and Connection Design

The physical wiring design translates the logical topology into a concrete rack layout with specific cable types, port assignments, and redundancy paths. Correct physical wiring is essential for HA failover to work as designed — a single cable failure should never take down a security boundary. The wiring design must be documented and verified during acceptance testing, with as-built diagrams updated after any changes.

Figure 4.2: Physical Device Wiring — Rack-level view showing dual NGFW appliances with HA sync cable (red), data ports (green), management network (blue), WAF cluster with load balancer cables, ISFW HA pair with trunk cables, core switches with fiber uplinks (yellow), and out-of-band management switch with console cables.

Cable Color Coding Standard

4.3 Inter-Zone Access Matrix

The inter-zone access matrix is the central policy document for the segmentation design. It defines, for each source-destination zone pair, whether traffic is permitted or denied by default, and what the allowed services are for permitted flows. The matrix must be reviewed and approved by the security team and zone owners before implementation, and it must be updated whenever a new flow is required. The matrix below represents the default baseline — specific deployments will add rows for application-specific flows.

4.4 High Availability Design Patterns

Every boundary enforcement point must have a defined HA design. The choice of HA pattern depends on the recovery time objective (RTO), the traffic volume, and the operational complexity the team can sustain. The three primary HA patterns used in segmentation deployments are described below, along with their trade-offs and recommended use cases.